July 2007 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] LUKS and its master key
by Jochen+opensuse-security＠Hayek.name 12 Dec '07

12 Dec '07

I found LUKS recently through SUSE Linux 10.3, and the other night a read an article in c't 2006/11. I can't seriously appreciate the technical internals, as I'm not too compentent there. Anyway: Kudos to Clemens Fruhwirth! But I am not really sure, whether I can trust, what I read in that article regarding the master key, spefically that the master key can be read from the LUKS volume by the sys admin without any difficulties. Does that really mean, that as soon as somebody gains control over my computer with a mounted LUKS encrypted (external) disc and he also manages to gain root priviliges, that he can retrieve the necessary information, to mount that disc himself with LUKS-means again?!? I mean without me passing the keys to him. If that is seriously so, I think I will have to find myself another disc encryption toolset, as I cannot tolerate, that intruders can deal with my personal data without my explicit permission and support. Whether those intruders have governmental permissions, I don't f...ing care. I appreciate your serious comments. J. --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

6 11

[opensuse-security] BIND 9: cryptographically weak query ids
by Stefan Jakobs 31 Jul '07

31 Jul '07

Hello, I'm running a bind DNS Server with SLES9. The website http://www.isc.org/index.pl?/sw/bind/bind-security.php announced the vulnerability CVE-2007-2926. Will SuSE release an update or patch for this vulnerability in the near future? Greetings Stefan --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 1

[opensuse-security] Re: [security-announce] SUSE Security Summary Report SUSE-SR:2007:014
by Frank Steiner 20 Jul '07

20 Jul '07

Marcus Meissner wrote > ______________________________________________________________________________ > > SUSE Security Summary Report > > Announcement ID: SUSE-SR:2007:014 > Date: Fri, 20 Jul 2007 12:00:00 +0000 Nothing about opera, at least in "pending"? 9.22 was released yesterday with some security fixes. cu, Frank -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr. 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: +49 89 2180-99-4049 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. * --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 2

[opensuse-security] How can I tell susefirewall not to log about a certain port?
by Carlos E. R. 18 Jul '07

18 Jul '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, In the /etc/sysconfig/SuSEfirewall2 file I have: FW_SERVICES_EXT_TCP="4662" But entries to that port are logged: Jul 15 14:07:25 nimrodel kernel: SFW2-INext-ACC-TCP IN=eth0 OUT= MAC=00:40:f4:2e:b1:21:00:30:da:70:d7:ea:08:00 SRC=189.... DST=192.168.1... LEN=48 TOS=0x00 PREC=0x00 TTL=112 ID=6454 DF PROTO=TCP SPT=50867 DPT=4662 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (0204058401010402) As it is a port I opened, I understand it should not be logged, it is not a "critical" port. I have: FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" What could I do so that they are not logged? I want other port logged, but not those I explicitly opened myself. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFGmg9ZtTMYHG2NR9URArYzAJ9Ty4P6d6pGX4TuOrv/8L4CPCWbsgCgjPOM lz6ZfwgOR1Eawj7JVyde26k= =ojto -----END PGP SIGNATURE----- --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

4 3

Re: [opensuse-security] packet labeling & routing decision based on these labels
by Philipp Snizek 17 Jul '07

17 Jul '07

> Philipp Snizek schrieb: >>> On Monday 16 July 2007 15:17:53 Philipp Snizek wrote: >>> >>>> Hi >>>> >>>> I have this scenario: >>>> >>>> Subnet A >>>> Hosts n ----- Gateway ----- Fileservers NFS >>>> >>>> Hosts n: mark packets >>>> Gateway: uses mark to make routing desicion > >>>> [...] > >>>> Or how would you do it? >>>> >>>> Thanks for your attention >>>> >>> Hi, >>> >>> How are you using the marks? If a client can spoof the IP and MAC >>> address, >>> it >>> could do so with the marks too. >>> >> Yes, it could, but then the attacker somehow has to learn what the mark >> looks like. If the attacker doesn't know the gateway will notice the >> spoofing with the first incoming packet. And thus, alerting the spoofing >> will not be a problem anymore. >> The only way I can think of would be a man-in-the-middle attack (e.g. >> with >> a notebook that has 2 interfaces set up as a linux bridge). >> > Which is not too difficult. No, it isn't. >> I also thought about using SECMARK with SELinux but that is too much of >> a >> pain and therefore too expensive to build. Also, I do not know whether >> SECMARK painted packets are painted permanently. >> >> >>> Securing your network from MAC or IP address spoofing may be done by >>> configuring the switches (if they are manageble, of course) - for >>> example >>> by >>> staticly assigning allowed MAC addresses on specific switch ports. If a >>> malicious client can connect to your network and spoof a valid identity >>> it >>> is >>> > This is not working! Every Script Kiddie can fake MAC-Addresses. ACK > If you want to leave Security to the Switch use 802.1x Port based > Authentication > with a secure Protocol. Yes. That would help it and also stop man in the middle at least between the switch and the Hosts n. have you got experience what performance impact 802.1x has on 1GBit/s ethernet? >>> already too late to secure protocols like NFS, which are not designed >>> to >>> be >>> used on an insecure network. >>> >> >> This is the design flaw in the network that currently cannot be fixed. >> That is also why I'm coming up with the idea of marking the packets. >> > If you have control over Client and Server, why not using AFS instead > of NFS? > AFS supports strong authentication and _encryption_ of transported Data. Because we use AFS and we know abouts its security features. However, experiences show that it never has been working really reliably. Imagine that Hosts n may be several hundred machines most probably mounting more than a total of 2000 NFS shares. Even NFS3 has a problem with this sort of load. We thought about using NFS4 but other colleagues made bad experiences. The last alternative would be Samba and CIFS. But that's all too much work. Philipp > Dirk > >> Thanks, >> PHilipp >> >> >> >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org >> <mailto:opensuse-security+unsubscribe@opensuse.org> >> For additional commands, e-mail: opensuse-security+help(a)opensuse.org >> <mailto:opensuse-security+help@opensuse.org> >> >> > -- > > TRIA IT-consulting GmbH > Joseph-Wild-Straße 20 > 81829 München > Germany > Tel: +49 (89) 92907-0 > Fax: +49 (89) 92907-100 > http://www.tria.de > > Registergericht München HRB 113466 > USt.-IdNr. DE 180017238 Steuer-Nr. 802/40600 > Geschäftsführer: Rosa Igl > > -------------------------------------------------------------------------------- > Nachricht von: Dirk.Schreiner(a)tria.de > Nachricht an: opensuse-security(a)opensuse.org > # Dateianhänge: 0 > --------------------------------------------------------------------- > To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org > For additional commands, e-mail: opensuse-security+help(a)opensuse.org > > --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

3 5

Re: [opensuse-security] packet labeling & routing decision based on these labels
by Philipp Snizek 16 Jul '07

16 Jul '07

> On Monday 16 July 2007 16:10:04 Philipp Snizek wrote: >> > On Monday 16 July 2007 15:17:53 Philipp Snizek wrote: >> >> Hi >> >> >> >> I have this scenario: >> >> >> >> Subnet A >> >> Hosts n ----- Gateway ----- Fileservers NFS >> >> >> >> Hosts n: mark packets >> >> Gateway: uses mark to make routing desicion >> >> >> >> Hosts n get their IP address via DHCP (IP address lease decision >> based >> >> on >> >> the client's MAC address). >> >> It is extremely simple to attach a notebook to Subnet A, spoof a >> legal >> >> client's IP and MAC addresses get UID and username and do the worst. >> >> >> >> Over the weekend I tried packet marking using iptables mark and >> connmark >> >> targets to label pakets at the Hosts n (iptables output -j MARK rule) >> >> and >> >> to have the Gateway based on these labels decide what to do with the >> >> pakets (ip rule with fwmark). I stopped trying when I found out that >> the >> >> labels are not given permanently when a marked packet leaves the >> >> interface >> >> of a host n. >> >> >> >> As I very much like the idea of labeling packets I wonder whether >> such a >> >> concept is possible with other linux tools. >> >> >> >> Or how would you do it? >> >> >> >> Thanks for your attention >> > >> > Hi, >> > >> > How are you using the marks? If a client can spoof the IP and MAC >> > address, it >> > could do so with the marks too. >> >> Yes, it could, but then the attacker somehow has to learn what the mark >> looks like. If the attacker doesn't know the gateway will notice the >> spoofing with the first incoming packet. And thus, alerting the spoofing >> will not be a problem anymore. > > Spoofing the mark is as easy as spoofing the IP and MAC. I generally agree with you. It is also easy to change the mark into unpredictability. But, as I said - unless you know otherwise - iptables marks are set as long as the packets are in the kernel. So marking packets seems not the way to go. Therefore, there is no point in discussing the spoofability of iptables marks. >> The only way I can think of would be a man-in-the-middle attack (e.g. >> with >> a notebook that has 2 interfaces set up as a linux bridge). >> I also thought about using SECMARK with SELinux but that is too much of >> a >> pain and therefore too expensive to build. Also, I do not know whether >> SECMARK painted packets are painted permanently. > > You don't need to have two network interfaces to do a man-in-the-middle > attack. And that is the beauty of it - it is so simple:) You do that with > IP > and MAC spoofing and is as simple as running a little tool, publicly > available. Sure it is. That is why I would want to paint the packets. We are discussing now who was first. The egg or the chicken. > > -- > Blade hails you... > > I know my dreams are made of you > Of you and only for you > --Nightwish > --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

1 0

[opensuse-security] packet labeling & routing decision based on these labels
by Philipp Snizek 16 Jul '07

16 Jul '07

Hi I have this scenario: Subnet A Hosts n ----- Gateway ----- Fileservers NFS Hosts n: mark packets Gateway: uses mark to make routing desicion Hosts n get their IP address via DHCP (IP address lease decision based on the client's MAC address). It is extremely simple to attach a notebook to Subnet A, spoof a legal client's IP and MAC addresses get UID and username and do the worst. Over the weekend I tried packet marking using iptables mark and connmark targets to label pakets at the Hosts n (iptables output -j MARK rule) and to have the Gateway based on these labels decide what to do with the pakets (ip rule with fwmark). I stopped trying when I found out that the labels are not given permanently when a marked packet leaves the interface of a host n. As I very much like the idea of labeling packets I wonder whether such a concept is possible with other linux tools. Or how would you do it? Thanks for your attention Philipp --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

3 4

[opensuse-security] Proplem with scp under SuSE10.1
by su.secu＠gmx.de 16 Jul '07

16 Jul '07

Hello, i have a poblem with the command scp, to copy large files to another host. After a few Bytes I got the message on the receiver: 'Disconnecting: Corrupted MAC on input' and on the sender 'received disconnect from xxx.xxx.xxx.xxx: 2: Corrupted MAC on input'. The receiver host is a SuSE 10.2 and the sender host is a SuSE 10.1, both host with all updates. When I search in the net I found the problem in context with the kernel and the nic's. Sender nic: Broadcom Corporation NetXtreme BCM5721 Gigabit Ethernet PCI Express Receiver nic: Broadcom Corporation NetXtreme BCM5714 Gigabit Ethernet (rev a3) Has anyone an idea to solve the problem? Klaus -- Ist Ihr Browser Vista-kompatibel? Jetzt die neuesten Browser-Versionen downloaden: http://www.gmx.net/de/go/browser --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

4 4